341–346 of 346 posts
https://developers.google.com/fonts/faq#what_does_using_the_... was updated today, confirming Google Fonts doesn't log IP addresses.
Given that, it's unclear to me personally what the difference is between Bunny Fonts and Google Fonts.
Earlier quoted context omitted.
> Svg is also often much larger than a font file, especially one that's subset. Subsetting is where SVG shines, though. For icon fonts, you can much more easily subset SVG icons than a font file. Font file subsetting needs dedicated tools like font editors (with Icomoon being a common choice these days) and often manual maintenance/upkeep, whereas SVG tree shaking is a natural part of any web bundler (webpack, etc) a…
I use Calibre for font subsetting, usually for use in ebooks, but I've used it for a website as well. The only gotcha I've found is that Calibre doesn't recognize css content attributes (`div.icon{content:"source:"}`), and that font names need to be correct. This is pretty trivial to get around, and generally only needs to be done once. I've never used webpack or any other bundler on any personal website I've written…
You aren't going to get easier subsetting in a modern browser than a folder full of SVGs and the browser only pulling the URLs it needs as it needs them rather than an entire bloated icon font format all at once up front. No need to double check that Calibre has got the right font subset from your CSS or to open Calibre at all, just upload the folder of SVGs and let the browser "subset" it, in the classic ways of HTML going back to its origins. Even less "automation" than Calibre.
Earlier quoted context omitted.
We are talking about saas, will you put your photos there? Or use yandex email?
Contrary to the weird Cold War sensibilities that rule a lot of HN's collective mindset for some reason, to me using Yandex Mail is no worse than using GMail. Let's be honest: all those big players sing all our data to whoever they like, any moment they like. Pretending one is better than another is dishonest.
Earlier quoted context omitted.
No, I'm not reinventing it, but extending it by: 1) Mandating it for certain types of resources 2) Extending caching to cover the cross-site case. Can you please explain the proposed timing-based attack?
Websites can use whether or not a resource is cached (one way to measure that is how long it takes to load) to uniquely identify your browser and track you across the internet. Another attack is to determine if you visited $popularWebsite by checking if resources it uses are cached (this could be useful to, for example, the Chinese government for surveillance on its citizens).
It seems like:
- Only standard resources ought to be cached (e.g. D3, common fonts, etc.). Perhaps these could be a free registration with the browser maker (e.g. I can always get them from cdn.mozilla.org or something), with some constraints (e.g. minimum number of users, some delay, or similar). As a user, I ought to have the option to cache *all* of these (which is helpful in bandwidth-constrained settings), either on my machine or on a proxy. If I'm at caltech, I can repoint my browser to grab these from localbox.caltech.edu.
- These shouldn't offer a unique fingerprint, since it only works once. If I needed to load comic-sans.ttf, I won't need to load it next time.
- I might be able to set a fingerprint (e.g. ask you to load 25 resources, and check if they're cached), but that's really for cross-site tracking (for which there are easier mechanisms), and it only works once. Once you've cached a resource, it's cached nearly forever. Your fingerprint changes each time, so it's not really traceable.
So the more I think about this:
(1) You raised a valid (and hard!) problem
(2) There seem to be reasonable solutions
I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…
Well, this is what all the fuss is about: respecting the law. I'm not saying the laws are good or bad, just that it is the only thing that most companies really care about.